Parent

Class/Module Index [+]

Quicksearch

Rex::Post::Meterpreter::Extensions::Stdapi::Sys::EventLog

This class provides access to the Windows event log on the remote machine.

Attributes

client[RW]

Public Class Methods

close(client, handle) click to toggle source

Close the event log

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 178
def self.close(client, handle)
        request = Packet.create_request('stdapi_sys_eventlog_close')
        request.add_tlv(TLV_TYPE_EVENT_HANDLE, handle);
        response = client.send_request(request, nil)
        return nil
end
finalize(client,handle) click to toggle source
# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 65
def self.finalize(client,handle)
        proc { self.close(client,handle) }
end
new(hand) click to toggle source

Initializes an instance of the eventlog manipulator.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 59
def initialize(hand)
        self.client = self.class.client
        self.handle = hand
        ObjectSpace.define_finalizer( self, self.class.finalize(self.client, self.handle) )
end
open(name) click to toggle source

Opens the supplied event log.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 35
def EventLog.open(name)
        request = Packet.create_request('stdapi_sys_eventlog_open')

        request.add_tlv(TLV_TYPE_EVENT_SOURCENAME, name);

        response = client.send_request(request)

        return self.new(response.get_tlv_value(TLV_TYPE_EVENT_HANDLE))
end

Public Instance Methods

_read(flags, offset = 0) click to toggle source

the low level read function (takes flags, not hash, etc).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 85
def _read(flags, offset = 0)
        request = Packet.create_request('stdapi_sys_eventlog_read')

        request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle)
        request.add_tlv(TLV_TYPE_EVENT_READFLAGS, flags)
        request.add_tlv(TLV_TYPE_EVENT_RECORDOFFSET, offset)

        response = client.send_request(request)

        EventLogSubsystem::EventRecord.new(
          response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER),
          response.get_tlv_value(TLV_TYPE_EVENT_TIMEGENERATED),
          response.get_tlv_value(TLV_TYPE_EVENT_TIMEWRITTEN),
          response.get_tlv_value(TLV_TYPE_EVENT_ID),
          response.get_tlv_value(TLV_TYPE_EVENT_TYPE),
          response.get_tlv_value(TLV_TYPE_EVENT_CATEGORY),
          response.get_tlv_values(TLV_TYPE_EVENT_STRING),
          response.get_tlv_value(TLV_TYPE_EVENT_DATA)
        )
end
clear() click to toggle source

Clear the specified event log (and return nil).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 166
def clear
        request = Packet.create_request('stdapi_sys_eventlog_clear')

        request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

        response = client.send_request(request)
        return self
end
close() click to toggle source

Instance method

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 186
def close
        self.class.close(self.client, self.handle)
end
each_backwards() click to toggle source

Iterator for read_backwards.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 137
def each_backwards
        begin
                loop do
                        yield(read_backwards)
                end
        rescue ::Exception
        end
end
each_forwards() click to toggle source

Iterator for read_forwards.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 117
def each_forwards
        begin
                loop do
                        yield(read_forwards)
                end
        rescue ::Exception
        end
end
length() click to toggle source

Return the number of records in the event log.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 72
def length
        request = Packet.create_request('stdapi_sys_eventlog_numrecords')

        request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

        response = client.send_request(request)

        return response.get_tlv_value(TLV_TYPE_EVENT_NUMRECORDS)
end
oldest() click to toggle source

Return the record number of the oldest event (not necessarily 1).

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 149
def oldest
        request = Packet.create_request('stdapi_sys_eventlog_oldest')

        request.add_tlv(TLV_TYPE_EVENT_HANDLE, self.handle);

        response = client.send_request(request)

        return response.get_tlv_value(TLV_TYPE_EVENT_RECORDNUMBER)
end
read_backwards() click to toggle source

Read the eventlog backwards, meaning from newest to oldest. Returns a EventRecord, and throws an exception after no more records.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 130
def read_backwards
        _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ)
end
read_forwards() click to toggle source

Read the eventlog forwards, meaning from oldest to newest. Returns a EventRecord, and throws an exception after no more records.

# File lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb, line 110
def read_forwards
        _read(EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ)
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.